There is an OS (Operating System) which has a core dump function for outputting content (a “memory image”) of a main memory at the time to an external storage device such as a hard disk, by trace information of a process designated by a command or when a program abnormally ends because of an error. For example, in UNIX (registered trademark) and LINUX (registered trademark), it is possible to obtain trace information of a designated process by using a truss command. For example, when a “gcore command” is used, it is possible to generate a memory image of the designated process as a core file.
A file including the memory image obtained in the core dump function as its content is called a “core file”.
A snapshot dump processing system is proposed to execute a snapshot dump according to a state of a switch for debug.
Patent Document 1: Japanese Laid-Open Patent Publication No. 60-238946
FIG. 5 is a diagram for explaining a specific example of a related art. As illustrated in #1 of FIG. 5, when a switch provided in an information processing apparatus (e.g., a UNIX server) is depressed, the information processing apparatus notifies an OS of the information processing apparatus of an interrupt of a panic instruction (refer to #2 of FIG. 5). The interrupt of the panic instruction is an interrupt for instructing the OS to execute panic processing. When the OS receives the interrupt of the panic instruction, the OS calls panic processing explained later (refer to #3 of FIG. 5). The OS causes a CPU (Central Processing Unit) to execute the panic processing (refer to #4 of FIG. 5). The panic processing is, for example, a display/recording processing for a panic message (a message indicating that the information processing apparatus is to be restarted), a synchronization processing for a file system, and a kernel dump processing. The kernel dump processing is a processing for acquiring a memory area used by a kernel. When a command for notifying the interrupt of the panic instruction is executed through a firmware, which is included in the information processing apparatus (refer to #5 of FIG. 5), similarly, the panic processing is executed as illustrated in #4 of FIG. 5, after the notification of the interrupt of the panic instruction to the OS and the invocation of the panic processing are executed as illustrated in #2 and #3 of FIG. 5.
When a trouble of hung-up of a system occurs, in other words, the system does not receive an input from an input device or does not send an output to an output device, for example, the kernel dump is performed by the depression of the switch or by the execution of the command, as explained with reference to FIG. 5, to investigate a cause of the occurrence of the hung-up. Further, total dump for obtaining an entire content of mounted memories is performed according to a procedure same as the kernel dump. However, when the entire system is hung up or no longer operable because a process operating in a user space is hung up or looped, trace information and a core file of the process which is a cause of the hung-up cannot be obtained. Therefore, it is difficult to identify the cause of the hung-up.
In the total dump, since the capacity of a dump file is large, it takes labor and time to identify and extract information of the process which is the cause of the hung-up. A portion swapped out from the mounted memory at a time hung-up is not obtained. In the kernel dump, information of the user space of the process which is the cause of the hung-up is not obtained.
In particular, there is a case that a trouble of stop of a boot processing for performing startup of the system of the information processing apparatus, and a case that a trouble of stop of a shutdown processing for performing shutdown of the system of the information processing apparatus occurs, because a processing of a specific process stops during the boot or during the shutdown of the system. In this case, it is impossible to log in the system, and to use a terminal for performing a command operation. Therefore, it is impossible to perform the command operation to sample the trace information and the core file of the process, so that an investigation often makes slow progress. In a related art in which a user depresses the switch provided in the information processing apparatus to perform the total dump or the kernel dump, even when a process causing a trouble can be identified, it is difficult to further identify a cause of stop of the process.
Therefore, when a hung-up occurs in the information processing apparatus, it is difficult to acquire information for a hung-up cause investigation, which is information used for investigating a cause of the hung-up.